Vulnerability Archives • Page 3 of 173 • Daily CyberSecurity

High-Severity NGINX Flaw Lets Attackers Inject Malicious Data

NGINX JavaScript Module Vulnerability CVE-2026-8711 NGINX 1.30.1 Security Update CVE-2026-42945 RCE NGINX Vulnerability CVE-2026-1642 NGINX Github - CVE-2025-23419

High-Severity NGINX Flaw Lets Attackers Inject Malicious Data

Do Son February 5, 2026

F5 warns of NGINX flaw CVE-2026-1642 (CVSS 8.2). MITM attackers can inject data into upstream TLS responses. Update to v1.29.5 immediately.

PoC Public & Exploited: Critical SolarWinds Help Desk Flaw Exploited in the Wild State-Sponsored Exploitation CISA KEV Catalog F5 BIG-IP RCE CISA KEV Catalog SolarWinds WHD Exploit CVE-2025-40551 Zimbra XSS Zero-Day CVE-2025-27915 Exploited Windows Security Vulnerabilities

State-Sponsored Exploitation CISA KEV Catalog F5 BIG-IP RCE CISA KEV Catalog SolarWinds WHD Exploit CVE-2025-40551 Zimbra XSS Zero-Day CVE-2025-27915 Exploited Windows Security Vulnerabilities

PoC Public & Exploited: Critical SolarWinds Help Desk Flaw Exploited in the Wild

Do Son February 4, 2026

The clock is ticking for organizations running SolarWinds Web Help Desk (WHD), as a nightmare scenario unfolds:...

Gatekeeper Breached: 4 Critical Ingress-Nginx Flaws Risk Cluster Secrets

Do Son February 3, 2026

Critical Ingress-Nginx flaws (CVE-2026-1580) allow RCE and secret theft via config injection. Upgrade to v1.13.7 or v1.14.3 immediately to secure K8s.

From User to SYSTEM: PoC Released for Zabbix Privilege Escalation CVE-2024-42330 Zabbix Privilege Escalation CVE-2025-27237

From User to SYSTEM: PoC Released for Zabbix Privilege Escalation

Do Son January 30, 2026

Exploit code released for Zabbix flaw CVE-2025-27237. Low-level users can gain SYSTEM privileges on Windows via OpenSSL config. Update now.

Exploit Code Publicly Released: Critical Firefox WebRTC Flaw Allows RCE (CVSS 9.8) Firefox built-in VPN Firefox VPN data limit, Firefox VPN countries, Mozilla VPN subscription Sanitizer API Firefox 148 Security Firefox WebRTC Vulnerability CVE-2025-14321 PoC Firefox VPN Feature, Browser-Only VPN Firefox Add-ons Rollback Firefox Encryption Firefox MKV support Firefox ESR, Windows 7

Firefox built-in VPN Firefox VPN data limit, Firefox VPN countries, Mozilla VPN subscription Sanitizer API Firefox 148 Security Firefox WebRTC Vulnerability CVE-2025-14321 PoC Firefox VPN Feature, Browser-Only VPN Firefox Add-ons Rollback Firefox Encryption Firefox MKV support Firefox ESR, Windows 7

Exploit Code Publicly Released: Critical Firefox WebRTC Flaw Allows RCE (CVSS 9.8)

Do Son January 27, 2026

Public PoC exploit released for critical Firefox WebRTC flaw CVE-2025-14321 (CVSS 9.8). AI-discovered bug allows remote code execution. Update now.

PoC Released for Critical Oracle E-Business Suite Flaw Exploited by Ransomware Oracle E-Business Suite RCE CVE-2025-61882 PoC

PoC Released for Critical Oracle E-Business Suite Flaw Exploited by Ransomware

Do Son January 26, 2026

Public PoC released for critical Oracle E-Business Suite RCE (CVE-2025-61882). Ransomware gangs are actively exploiting this CVSS 9.8 flaw. Patch now.

Public PoC Exploit Released for Critical Android Flaw Grants Apps Permissions Without You Knowing Android CVE-2024-23700 Zero-Interaction Exploit Candiru spyware Android vulnerability, security update

Android CVE-2024-23700 Zero-Interaction Exploit Candiru spyware Android vulnerability, security update

Public PoC Exploit Released for Critical Android Flaw Grants Apps Permissions Without You Knowing

Do Son January 23, 2026

Public PoC exploit for Android CVE-2024-23700 allows critical privilege escalation without user interaction. WearOS & Custom ROMs are at risk.

7 Million Exposed: Critical CVSS 9.8 RCE Vulnerability Hits Laravel Reverb Laravel Reverb Vulnerability CVE-2026-23524

7 Million Exposed: Critical CVSS 9.8 RCE Vulnerability Hits Laravel Reverb

Do Son January 22, 2026

Laravel Reverb flaw CVE-2026-23524 (CVSS 9.8) puts 7M apps at risk of RCE via Redis. Update to v1.7.0 or disable scaling now to stay secure.

10-Year-Old GNU Inetutils Telnetd Flaw Lets Hackers Log In as Root via “-f root” GNU Inetutils Telnetd Root Authentication Bypass

10-Year-Old GNU Inetutils Telnetd Flaw Lets Hackers Log In as Root via “-f root”

Do Son January 21, 2026

Critical GNU Inetutils telnetd flaw allows unauthenticated root access via "-f root". Affects v1.9.3-2.7. Disable telnet immediately to stay safe.

PoC Exploit Released: Failed Windows Patch Leaks Kernel Secrets Windows Kernel Exploit CVE-2025-53136

PoC Exploit Released: Failed Windows Patch Leaks Kernel Secrets

Do Son January 19, 2026

A failed patch created Windows kernel flaw CVE-2025-53136. With reliable PoC exploit code now public, KASLR is bypassed. Update your systems now.

Exploit Code Published: Critical FortiSIEM Flaw Grants Unauthenticated Root Access FortiSIEM PoC Exploit CVE-2025-64155

Exploit Code Published: Critical FortiSIEM Flaw Grants Unauthenticated Root Access

Do Son January 14, 2026

PoC exploit code released for critical FortiSIEM flaw CVE-2025-64155 (CVSS 9.4). Unauthenticated RCE allows root access. Upgrade to v7.4.1 now.

Details Exposed: High-Severity Aruba VIA Root Flaw Publicly Disclosed

shell-quote command injection AI-Driven Vulnerabilities Q1 2026 Cyber Threats vm2 Sandbox Escape Node.js RCE upKeeper Privilege Escalation CVE-2026-2449 Pharos Controls Vulnerability Root Access Exploit Cybersecurity Vulnerability Roundup CVSS 10.0 Flaws Shadow Archives CVE-2026-0866 MS-Agent Prompt Injection CVE-2026-2256 basic-ftp Path Traversal CVE-2026-27699 telnetd Root Vulnerability CVE-1999-0073 Regression USR-W610 Vulnerabilities End-of-Life IoT Security IceWarp Security Update IceWarp Vulnerabilities Airleader Master Vulnerability CVE-2026-1358 ZLAN5143D Vulnerability CISA ICS Advisory Acronis Cyber Protect Vulnerability CVE-2025-30411 WAGO 852 Vulnerability OT Network Security SandboxJS Vulnerability Sandbox Escape (CVSS 10.0) Kubernetes Local Path Provisioner CVE-2025-62878 CISA Unresponsive Vendors Avation & RISS Vulnerabilities KiloView Vulnerability CVE-2026-1453 OpenClaw RCE vulnerability Johnson Controls Vulnerability CVE-2025-26385 SandboxJS Vulnerability CVE-2026-23830 ibaPDA Vulnerability CVE-2025-14988 Protobuf Vulnerability CVE-2026-0994 AVEVA Process Optimization Vulnerability CVE-2025-61937 ConnectWise PSA Vulnerability CVE-2026-0695 Aruba VIA Vulnerability CVE-2025-37186 aiohttp v3.13.3, Denial of Service (DoS) SmarterMail RCE, CVE-2025-52691 Airoha RACE, Headphone Jacking HPE OneView RCE CVE-2025-37164 FreePBX Auth Bypass, PBX Takeover ScreenConnect Config Flaw, Untrusted Extensions Ruby SAML Auth Bypass, XML Parser Differential Devolutions SQL Injection, Password Manager Flaw Vivotek Unauthenticated RCE, EOL IP Camera Flaw Lynx+ Critical Flaw, Unauthenticated Reset Firebox Default Credentials, CVE-2025-59396 Veeder-Root RCE, Critical ATG Flaw ArcGIS Server SQLi Watchdoc RCE, CVE-2025-58384 Delta DIALink Daikin Security Gateway, authentication bypass Frostbyte10, industrial controller security SunPower, vulnerability Ubiquiti UniFi Connect, EV Station Vulnerabilities Adobe Experience Manager, RCE Vulnerability UniFi Access, Command Injection LDAPNightmare - CVE-2025-1316

Details Exposed: High-Severity Aruba VIA Root Flaw Publicly Disclosed

Do Son January 14, 2026

HPE warns: Details of Aruba VIA root flaw (CVE-2025-37186) are public. Linux users exposed to LPE. No patch yet—apply the workaround now.

Siemens Issues Critical Alert for Maximum 10.0 Vulnerability in Industrial Systems Siemens Edge Vulnerability CVE-2025-40805 CVE-2024-32741 - CVE-2025-27494 Siemens, Industrial Edge, CVE-2024-54092

Siemens Edge Vulnerability CVE-2025-40805 CVE-2024-32741 - CVE-2025-27494 Siemens, Industrial Edge, CVE-2024-54092

Siemens Issues Critical Alert for Maximum 10.0 Vulnerability in Industrial Systems

Do Son January 14, 2026

Urgent: Siemens Edge flaw CVE-2025-40805 (CVSS 10) allows remote account takeover. Update SIMATIC & IOT2050 devices immediately to secure ops.

Hikvision Security Cameras and Access Controls Hit by Stack Overflow Flaws Hikvision Vulnerability CVE-2026-0709 Hikvision Vulnerability CVE-2025-66176 Hikvision, vulnerability Canada Hikvision Ban, National Security Hikvision firmware updates

Hikvision Vulnerability CVE-2026-0709 Hikvision Vulnerability CVE-2025-66176 Hikvision, vulnerability Canada Hikvision Ban, National Security Hikvision firmware updates

Hikvision Security Cameras and Access Controls Hit by Stack Overflow Flaws

Do Son January 13, 2026

High-severity Hikvision stack overflow flaws (CVE-2025-66176) allow attackers to crash cameras & NVRs via LAN. Update firmware now to prevent DoS.

WAFs Wide Open: Critical OWASP CRS Flaw Bypasses Filters Radware WAF, WAF bypass OWASP CRS Vulnerability CVE-2026-21876

WAFs Wide Open: Critical OWASP CRS Flaw Bypasses Filters

Do Son January 12, 2026

Critical OWASP CRS flaw CVE-2026-21876 (CVSS 9.3) allows XSS bypass via UTF-7 encoding. ModSecurity & Coraza users: update to v4.22.0 immediately.

Critical Centreon Alert: 9.8 Severity Flaw Exposes IT Monitoring CVE-2024-55573 & CVE-2024-53923 Centreon AWIE Vulnerabilities CVE-2025-15029

Critical Centreon Alert: 9.8 Severity Flaw Exposes IT Monitoring

Do Son January 9, 2026

Centreon warns of critical AWIE vulnerabilities CVE-2025-15029 (CVSS 9.8) & CVE-2025-15026. Update to v25.10.2 now to prevent unauthenticated SQL injection.

“Sophisticated” Zero-Day Demystified: Public Exploit Drop Blows Cover on Critical Apple WebKit Flaw Apple Zero-Day CVE-2025-43529 WebKit Zero-Day, Targeted iOS Spyware Apple spyware alerts, zero-click attacks Apple, trademark lawsuit CVE-2024-54527 PoC exploit Apple, App Store

Apple Zero-Day CVE-2025-43529 WebKit Zero-Day, Targeted iOS Spyware Apple spyware alerts, zero-click attacks Apple, trademark lawsuit CVE-2024-54527 PoC exploit Apple, App Store

“Sophisticated” Zero-Day Demystified: Public Exploit Drop Blows Cover on Critical Apple WebKit Flaw

Do Son January 8, 2026

Exploit blueprints for Apple zero-day CVE-2025-43529 are now public. Millions of iPhones and Macs are at risk. Update to iOS 26.2 immediately.

wolfSSH Alert: Critical Logic Flaw Exposes Client Passwords in Clear Text wolfSSL Vulnerability Certificate Validation Bypass wolfSSH Vulnerability CVE-2025-14942

wolfSSL Vulnerability Certificate Validation Bypass wolfSSH Vulnerability CVE-2025-14942

wolfSSH Alert: Critical Logic Flaw Exposes Client Passwords in Clear Text

Do Son January 7, 2026

wolfSSH 1.4.22 patches critical flaw CVE-2025-14942 (CVSS 9.4). The bug allows attackers to bypass authentication and steal passwords. Update immediately.

The Open Door: Critical 9.8 Severity Flaw in Harvester Lets Hackers Hijack New Servers Harvester HCI, CVE-2025-62877

The Open Door: Critical 9.8 Severity Flaw in Harvester Lets Hackers Hijack New Servers

Do Son January 6, 2026

CVE-2025-62877: A 9.8 critical flaw in Harvester HCI allows attackers to hijack servers using default credentials during install. Update to v1.7.0!

Researcher Details Stack Buffer Overflow Flaw in Net-SNMP snmptrapd with PoC Net-SNMP, CVE-2025-68615

Researcher Details Stack Buffer Overflow Flaw in Net-SNMP snmptrapd with PoC

Do Son January 6, 2026

D4mianWayne details CVE-2025-68615, a 9.8 critical flaw in Net-SNMP allowing unauthenticated RCE. Update to v5.9.5 or v5.10.pre2 now!

Fragged Files: Critical Zero-Day Hits Quake III Arena Engines via Directory Traversal Quake III Arena, Zero-Day Vulnerability

Fragged Files: Critical Zero-Day Hits Quake III Arena Engines via Directory Traversal

Do Son January 5, 2026

A zero-day in Quake III Arena engines (ioquake3, OpenArena) allows attackers to read sensitive system files and target players. Check RCON access now!

Zero-Click Hijack: The PrestaShop Checkout Flaw That Turns Emails Into Full Account Access, PoC Publishes CVE-2023-39526 PrestaShop

Zero-Click Hijack: The PrestaShop Checkout Flaw That Turns Emails Into Full Account Access, PoC Publishes

Do Son January 5, 2026

PrestaShop patches a 9.1 critical flaw (CVE-2025-61922) in the Checkout module. Attackers can hijack accounts via email. PoC available.